Oracle 故障实例 - 通过备份恢复到某时间点故障恢复

一、环境和故障描述

1.数据库版本：oracle 11g , linux ；OA系统的后台数据库。

2. 同事在做正式机数据迁移到测试机时，不小心删除了正式机的数据。导致大量生产数据丢失，系统故障。

3.万幸的是正式机每日都做了数据备份，同时归档日志保留了7天。

二、故障处理过程

1.停止前台OA系统服务，避免后续数据写入数据库，造成更多的错乱。

2.检查备份数据的完整性和归档日志。

3.行动计划：首先使用备份集还原到当天，再用归档日子还原到故障的时间点。

三、参考内容

关于 oracle 日志：

Oracle数据库有两种日志：在线重做日志（ONLINE REDO LOGS）和归档日志（ARCHIVE LOGS）。归档日志是当在线重做日志满了之后，Oracle会将溢出的内容自动归档到指定的位置，这样可以保持在线重做日志的可用性，便于数据库的正常运行。

1.查看数据库是否启用了归档模式, 如果返回`ARCHIVELOG`，则表示数据库处于归档模式。

SQL> SELECT log_mode FROM v$database;

LOG_MODE
------------
ARCHIVELOG

2.查看归档日志的存储位置: 通过参数 db_recovery_file_dest 找到位置，进一步找到日志文件，可以确定日志是否存在。

SQL> SHOW PARAMETER db_recovery_file_dest;

NAME                                 TYPE        VALUE
------------------------------------ ----------- ------------------------------
db_recovery_file_dest                string      /u01/app/oracle/flash_recovery
                                                 _area
db_recovery_file_dest_size           big integer 50G
SQL>

[root@oa archivelog]# pwd
/u01/app/oracle/flash_recovery_area/ECOLOGY/archivelog
[root@oa archivelog]# ll
ܼ 48
drwxr-x--- 2 oracle oinstall 4096 05-30 01:08 2025_05_22
drwxr-x--- 2 oracle oinstall 4096 05-23 18:05 2025_05_23
drwxr-x--- 2 oracle oinstall 4096 05-24 23:40 2025_05_24
drwxr-x--- 2 oracle oinstall 4096 05-26 17:00 2025_05_26
drwxr-x--- 2 oracle oinstall 4096 05-27 23:00 2025_05_27
drwxr-x--- 2 oracle oinstall 4096 05-28 21:02 2025_05_28
drwxr-x--- 2 oracle oinstall 4096 05-29 22:02 2025_05_29
drwxr-x--- 2 oracle oinstall 4096 05-30 15:24 2025_05_30
drwxr-x--- 2 oracle oinstall 4096 05-31 03:01 2025_05_31
drwxr-x--- 2 oracle oinstall 4096 06-01 03:00 2025_06_01
drwxr-x--- 2 oracle oinstall 4096 06-02 03:00 2025_06_02
drwxr-x--- 2 oracle oinstall 4096 06-03 03:00 2025_06_03
[root@oa archivelog]# cd 2025_05_30
[root@oa 2025_05_30]# ls
o1_mf_1_2496_n3lj4y8k_.arc  o1_mf_1_2497_n3lqbc9r_.arc

合并一下命令：ls -l $ORACLE_BASE/flash_recovery_area/$ORACLE_SID/archivelog/

ls -l  $ORACLE_BASE/flash_recovery_area/$ORACLE_SID/archivelog/
drwxr-x--- 2 oracle oinstall 4096 05-30 01:08 2025_05_22
drwxr-x--- 2 oracle oinstall 4096 05-23 18:05 2025_05_23
drwxr-x--- 2 oracle oinstall 4096 05-24 23:40 2025_05_24
drwxr-x--- 2 oracle oinstall 4096 05-26 17:00 2025_05_26
drwxr-x--- 2 oracle oinstall 4096 05-27 23:00 2025_05_27
drwxr-x--- 2 oracle oinstall 4096 05-28 21:02 2025_05_28
drwxr-x--- 2 oracle oinstall 4096 05-29 22:02 2025_05_29
drwxr-x--- 2 oracle oinstall 4096 05-30 15:24 2025_05_30
drwxr-x--- 2 oracle oinstall 4096 05-31 03:01 2025_05_31
drwxr-x--- 2 oracle oinstall 4096 06-01 03:00 2025_06_01
drwxr-x--- 2 oracle oinstall 4096 06-02 03:00 2025_06_02
drwxr-x--- 2 oracle oinstall 4096 06-03 03:00 2025_06_03

也可以通过 sql 查表的方式，取到日志情况

SQL> SELECT SEQUENCE#, FIRST_TIME, NEXT_TIME, DELETED
FROM V$ARCHIVED_LOG  ORDER BY SEQUENCE#;

 SEQUENCE# FIRST_TIME         NEXT_TIME          DEL
---------- ------------------ ------------------ ---
         1 30-MAY-25          31-MAY-25          NO
         2 31-MAY-25          01-JUN-25          NO
         3 01-JUN-25          02-JUN-25          NO
         4 02-JUN-25          03-JUN-25          NO
      2446 22-APR-25          23-APR-25          YES
      2447 23-APR-25          24-APR-25          YES
      2448 24-APR-25          24-APR-25          YES
      2449 24-APR-25          25-APR-25          YES
      2450 25-APR-25          26-APR-25          YES
      2451 26-APR-25          27-APR-25          YES
      2452 27-APR-25          27-APR-25          YES

最方便的是用 rman 工具来查看，直接可以看到文件列表

[oracle@oa ~]$ rman target /
RMAN>list archivelog all;
Key     Thrd Seq     S Low Time
------- ---- ------- - ---------
2518    1    2486    A 22-MAY-25
        Name: /u01/app/oracle/flash_recovery_area/ECOLOGY/archivelog/2025_05_23/o1_mf_1_2486_n30l3s5w_.arc

2519    1    2487    A 23-MAY-25
        Name: /u01/app/oracle/flash_recovery_area/ECOLOGY/archivelog/2025_05_24/o1_mf_1_2487_n31kgf18_.arc

2520    1    2488    A 24-MAY-25
        Name: /u01/app/oracle/flash_recovery_area/ECOLOGY/archivelog/2025_05_24/o1_mf_1_2488_n33t3nz2_.arc

2521    1    2489    A 24-MAY-25
        Name: /u01/app/oracle/flash_recovery_area/ECOLOGY/archivelog/2025_05_26/o1_mf_1_2489_n36t5opb_.arc

2522    1    2490    A 26-MAY-25
        Name: /u01/app/oracle/flash_recovery_area/ECOLOGY/archivelog/2025_05_26/o1_mf_1_2490_n38cffny_.arc

2523    1    2491    A 26-MAY-25
        Name: /u01/app/oracle/flash_recovery_area/ECOLOGY/archivelog/2025_05_27/o1_mf_1_2491_n3b20c1k_.arc

2524    1    2492    A 27-MAY-25
        Name: /u01/app/oracle/flash_recovery_area/ECOLOGY/archivelog/2025_05_27/o1_mf_1_2492_n3cnvq0f_.arc

2525    1    2493    A 27-MAY-25
        Name: /u01/app/oracle/flash_recovery_area/ECOLOGY/archivelog/2025_05_28/o1_mf_1_2493_n3g2clx0_.arc

2526    1    2494    A 28-MAY-25
        Name: /u01/app/oracle/flash_recovery_area/ECOLOGY/archivelog/2025_05_29/o1_mf_1_2494_n3hs6z9h_.arc

2527    1    2495    A 29-MAY-25
        Name: /u01/app/oracle/flash_recovery_area/ECOLOGY/archivelog/2025_05_29/o1_mf_1_2495_n3jt7s16_.arc

2528    1    2496    A 29-MAY-25
        Name: /u01/app/oracle/flash_recovery_area/ECOLOGY/archivelog/2025_05_30/o1_mf_1_2496_n3lj4y8k_.arc

2529    1    2497    A 30-MAY-25
        Name: /u01/app/oracle/flash_recovery_area/ECOLOGY/archivelog/2025_05_30/o1_mf_1_2497_n3lqbc9r_.arc

2530    1    1       A 30-MAY-25
        Name: /u01/app/oracle/flash_recovery_area/ECOLOGY/archivelog/2025_05_31/o1_mf_1_1_n3n04kyr_.arc

redo logs VS. archive log

归档日志archive log是当数据库运行在归档模式下时，一个redo log file(group)写满后，由ARCn进程将重做日志的内容备份到归档日志文件下，然后这个redo log file(group)才能被下一次使用。

归档日志文件存于 flash_recovery_area/sid/archivelog/ 目录。

redo log VS. undo log

redo log 记录所有操作，主要是用于数据恢复。 undo log 在事务提交前，记录事务处理的操作，当事务异常时，用于回滚事务。

flashback log VS. redo log

flashback log 是独立于 redo log 的另一套体系，用于闪回到某个操作块前的操作。相对而言 redolog 适用性更广。

RMAN 备份和恢复

1.参考备份脚本

#file: /home/back.sh
#ByZhangKai
#change by xulong
#2017-1-17
#Revised by xin
#2021-12-27
#!/bin/bash

#---------------------------------------------------
# please modify  cron config file, ref following
# vim /etc/crontab
# add line :
#  0 1 * * 2-5 root sh  /home/back.sh
#---------------------------------------------------
logfile=/home/backup/back_$(date +%Y%m%d_%H%M%S).log

su - root >> $logfile <<EOF
#stop web server
#echo stop ebridge server
#bash /usr/ebridge/stop.sh
echo stop weaver server
bash /usr/weaver/Resin4/bin/stopresin.sh

#bash /usr/weaver/EMobile/stop.sh
EOF

#stop oracle , backup db , restart db
su - oracle >>$logfile <<EOF
echo $(date +%Y%m%d_%H%M%S) -------rman start
rman target /  << EOF_RMAN
shutdown immediate;
startup mount;
run{
allocate channel d1 type disk;
backup full database
include current controlfile
format '/home/backup/db_%d_%s_%p_%t_%T';
release channel d1;
}
delete noprompt archivelog all completed before 'sysdate-7';  #delete arch log before 7 days
shutdown immediate;
startup
exit;
EOF
echo $(date +%Y%m%d_%H%M%S) -------rman end

su - oracle >>  $logfile <<EOF
echo $(date +%Y%m%d_%H%M%S) -------restart TNS start
lsnrctl stop
lsnrctl start
echo $(date +%Y%m%d_%H%M%S) -------restart TNS end
EOF

su - root >> $logfile <<EOF
#tar OA files
echo tar files of  ecology and ebridge
tar cvf /home/backup/$(date +%Y%m%d%H%m%S).tar.gz /usr/weaver/ecology/*

#copy files to backup server
echo copy files to backup server
mount -t cifs -o username=user,password='pwd' //xxx.xxx.xxx.xxx/d$/ECOLOGY_BACKUP /home/ECOLOGY_BACKUP/

cp -R -v  /home/backup/* /home/ECOLOGY_BACKUP/
cp -f /home/back.sh /home/ECOLOGY_BACKUP/
rm -rf /home/backup/*
umount /home/ECOLOGY_BACKUP/


#start Web Server

echo start weaver web server
bash /usr/weaver/Resin4/bin/startresin.sh

#echo start ebridge  server
#bash /usr/ebridge/start.sh
#bash /usr/weaver/EMobile/start.sh

EOF

2.参考恢复脚本

恢复到某时点前

rman target / 
restore database until time  "to_date('2025-05-30 13:20:00','YYYY-MM-DD HH24:MI:SS')"
RECOVER DATABASE UNTIL TIME   "to_date('2025-05-30 13:20:00','YYYY-MM-DD HH24:MI:SS')"
ALTER DATABASE OPEN RESETLOGS;

3.查看备份文件的位置（恢复时把备份集复制到对应位置，方便恢复）

[oracle@oa oracle]$ rman target /

Recovery Manager: Release 11.2.0.1.0 - Production on Tue Jun 3 10:04:47 2025

Copyright (c) 1982, 2009, Oracle and/or its affiliates.  All rights reserved.

connected to target database: ECOLOGY (DBID=4126113958)

RMAN> list backup;

using target database control file instead of recovery catalog

List of Backup Sets
===================


BS Key  Type LV Size       Device Type Elapsed Time Completion Time
------- ---- -- ---------- ----------- ------------ ---------------
3132    Full    9.39M      DISK        00:00:01     10-DEC-24
        BP Key: 3133   Status: AVAILABLE  Compressed: NO  Tag: TAG20241210T010048
        Piece Name: /home/backup/db_ECOLOGY_3162_1_1187312844_20241210       《**********
  SPFILE Included: Modification time: 10-DEC-24
  SPFILE db_unique_name: ECOLOGY

4.查看错误语句执行时间点（造成故障的误删sql执行点）

[oracle@oa alert]$ ls -l  $ORACLE_BASE/diag/rdbms/$ORACLE_SID/$ORACLE_SID/alert/
ܼ 22988
-rw-r----- 1 oracle oinstall 10485934 2024-09-03 log_13.xml
-rw-r----- 1 oracle oinstall 10485875 04-15 01:08 log_14.xml
-rw-r----- 1 oracle oinstall  2519822 06-03 03:00 log.xml

[oracle@oa alert]$ vim log.xml

------------------
<msg time='2025-05-30T13:21:36.969+08:00'   <------------- 找到时间点
 org_id='oracle' comp_id='rdbms'
 msg_id='opiexe:2994:4222364190' client_id='' type='NOTIFICATION'
 group='admin_ddl' level='16' host_id='oa.hongshang.cn'
 host_addr='xxx.xxx.xx.xx' module='sqlplus@oa.xxxxxxxx.cn (TNS V1-V3)' pid='28673'>
 <txt>drop tableSpace ecology including contents and datafiles      <----------------
 </txt>
</msg>
<msg time='2025-05-30T13:22:38.194+08:00' org_id='oracle' comp_id='rdbms'